skydive-cli 0.2.0-beta.618 → 0.2.0-beta.624

package/README.md

@@ -6,6 +6,53 @@ The Skydive CLI — manage agents and chat with them from the terminal.
 npx skydive-cli --help
 ```
 
+## Installing
+
+Two ways to install, depending on whether you have a Node toolchain:
+
+**npm (needs Node ≥ 20):**
+
+```sh
+npm install -g skydive-cli   # then: skydive --help
+# or run without installing:
+npx skydive-cli --help
+```
+
+**Standalone binary (no Node required):**
+
+```sh
+curl -fsSL https://skydive.com/api/v1/cli/install.sh | sh
+```
+
+Installs a self-contained `skydive` to `~/.local/bin`. The installer detects
+your OS/arch, downloads the matching binary from the release CDN, verifies its
+sha256, and installs it. Options via env vars: `SKYDIVE_CHANNEL=canary` for the
+canary line, `SKYDIVE_VERSION=X.Y.Z` to pin a version, `SKYDIVE_INSTALL_DIR` to
+choose the directory.
+
+## Updating
+
+```sh
+skydive update            # update to the latest release
+skydive update --check    # just report whether an update is available
+```
+
+A **binary** install self-updates in place (download → verify sha256 → atomic
+replace). An **npm/yarn/pnpm/bun** install is owned by your package manager, so
+`skydive update` offers to run the right upgrade command for it and relaunches
+the CLI on the new version.
+
+The CLI also checks for updates in the background (at most once a day, never
+blocking a command) and prints a one-line notice when a newer version exists.
+Control this in `config.json` or via env vars:
+
+- `autoupdate`: `"patch"` (default — silently self-apply a stable **patch**
+  release of a binary install; notify for minor/major, canary, and
+  package-manager installs), `"notify"` (only ever print the notice), or
+  `false` (no auto-update and no notice). Env override: `SKYDIVE_AUTOUPDATE`.
+- `updateCheck: false` (or `SKYDIVE_NO_UPDATE_CHECK` / `NO_UPDATE_NOTIFIER`)
+  turns the background check off entirely.
+
 ## Authentication
 
 Sign in once via the browser — the same shape as `doppler login`: the CLI

package/dist/js/bin.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as setActiveWorkspace, S as listWorkspaces, T as version, _ as themes, b as getActiveWorkspaceId, o as brandHelpArt, t as installCrashHandler, w as name, x as getSessionIdentity, y as ensureActiveOrganization } from "./install-BhPuzBxW.mjs";
-import { A as getUpdateCheckDisabled, C as getLastSeenVersion, D as getShareMachineDefault, I as saveConfig, L as saveSession, M as resolveConfig, N as resolveManagementAuth, O as getStoredApiKeyId, P as resolveSession, S as getConfigPath, _ as API_KEY_PREFIX, b as DEFAULT_WEB_URL, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as resolveAppUrl, k as getStoredApiKeyWorkspaceName, v as DEFAULT_API_URL, w as getPromptHistoryPath, x as deleteConfig, z as setLastSeenVersion } from "./print-CNIvmpqW.mjs";
+import { C as setActiveWorkspace, S as listWorkspaces, T as version, _ as themes, b as getActiveWorkspaceId, o as brandHelpArt, t as installCrashHandler, w as name, x as getSessionIdentity, y as ensureActiveOrganization } from "./install-DKTnh1gy.mjs";
+import { A as resolveAppUrl, C as getPromptHistoryPath, D as getStoredApiKeyId, E as getShareMachineDefault, F as saveConfig, I as saveSession, M as resolveManagementAuth, N as resolveSession, O as getStoredApiKeyWorkspaceName, R as setLastSeenVersion, S as getLastSeenVersion, _ as API_KEY_PREFIX, b as deleteConfig, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as resolveConfig, k as getUpdateCheckDisabled, v as DEFAULT_API_URL, x as getConfigPath } from "./print-DaPpTqxu.mjs";
 import { n as printError, r as printTable, t as output } from "./output-DYzzdXYV.mjs";
 import { n as createRestClient } from "./rest-Q5yl_b2-.mjs";
 import { a as registerPortalDevice, i as grantPortalAccess, n as fetchPortalDevices, o as revokePortalAccess, r as findThisDevice, s as machineIdentity } from "./client-DT9bWi1D.mjs";
@@ -17,7 +17,9 @@ import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import zlib from "node:zlib";
+import fsp from "node:fs/promises";
 import semver from "semver";
+import { createInterface } from "node:readline";
 
 //#region src/types.ts
 const NON_INTERACTIVE_ENV_VARS = [
@@ -1196,7 +1198,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-CaWHIM4R.mjs");
+		const { runChat } = await import("./boot-CI6nXtmu.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1231,7 +1233,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 	});
 	const extra = (argv.print ?? "").trim();
 	const prompt = buildImportSeedPrompt(process.cwd()) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
-	const { runPrint } = await import("./print-nefugWMx.mjs");
+	const { runPrint } = await import("./print-CB6L_1YB.mjs");
 	try {
 		const result = await runPrint({
 			appUrl,
@@ -1512,7 +1514,7 @@ const chatCommand = {
 			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
 			process.exit(1);
 		}
-		const { runChat } = await import("./boot-CaWHIM4R.mjs");
+		const { runChat } = await import("./boot-CI6nXtmu.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1549,7 +1551,7 @@ async function runPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { runPrint, readStdin } = await import("./print-nefugWMx.mjs");
+	const { runPrint, readStdin } = await import("./print-CB6L_1YB.mjs");
 	let prompt = (argv.print ?? "").trim();
 	if (!prompt) {
 		if (process.stdin.isTTY) {
@@ -1623,7 +1625,7 @@ const getCommand = {
 			printError(`${session.error.message} Run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
-		const { messageGet } = await import("./print-nefugWMx.mjs");
+		const { messageGet } = await import("./print-CB6L_1YB.mjs");
 		try {
 			const result = await messageGet({
 				appUrl,
@@ -1820,7 +1822,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-CaWHIM4R.mjs");
+			const { runWorkspacePicker } = await import("./boot-CI6nXtmu.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -2172,7 +2174,7 @@ const sandboxCommand = {
 	handler: async (argv) => {
 		const session = requireSession(argv);
 		const { createRestClient } = await import("./rest-CBROy0L-.mjs");
-		const { resolveAgent } = await import("./print-nefugWMx.mjs");
+		const { resolveAgent } = await import("./print-CB6L_1YB.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -2253,6 +2255,630 @@ async function runPty({ session, agentId, agentName }) {
 	return result.code;
 }
 
+//#endregion
+//#region src/update-check/manifest.ts
+/**
+* The release manifest the binary pipeline publishes
+* (`.github/workflows/release-skydive-cli-binaries.yml`) and the api serves
+* (`apps/anyone/api/src/routes/cli-releases.ts`). The update *check* only
+* needs `version` (see ./sources.ts), but the self-updater
+* (`../commands/update.ts`) needs the per-target byte pointer + integrity
+* digest too, so the full shape lives here and both consume it.
+*
+* Kept deliberately in sync with the api's `manifestSchema`: a field the api
+* validates but we drop here is fine, but a field we *require* that the api
+* doesn't emit would make every install fail — so required fields mirror the
+* api exactly (name, version, channel, per-target key/sha256/size).
+*/
+const releaseManifestSchema = z.object({
+	name: z.string().min(1),
+	version: z.string().min(1),
+	channel: z.string().min(1),
+	pubDate: z.string().optional(),
+	targets: z.record(z.object({
+		key: z.string().min(1),
+		sha256: z.string().regex(/^[0-9a-f]{64}$/),
+		size: z.number().int().positive()
+	}))
+});
+/**
+* The four release targets the pipeline builds. Named `<os>-<arch>` to match
+* the manifest's `targets` keys and the install script's `$OS-$ARCH`.
+*/
+const RELEASE_TARGETS = [
+	"darwin-arm64",
+	"darwin-x64",
+	"linux-arm64",
+	"linux-x64"
+];
+function isReleaseTarget(value) {
+	return RELEASE_TARGETS.some((target) => target === value);
+}
+/**
+* Map this host's `process.platform` / `process.arch` to a release target,
+* or null when we don't publish a binary for it. Mirrors the install
+* script's `uname -s` / `uname -m` normalization (arm64/aarch64 -> arm64,
+* x86_64/amd64 -> x64) so a CLI self-update resolves the same object a fresh
+* `curl | sh` install would.
+*/
+function hostReleaseTarget(platform, arch) {
+	const os = platform === "darwin" ? "darwin" : platform === "linux" ? "linux" : null;
+	if (!os) return null;
+	const cpu = arch === "arm64" || arch === "aarch64" ? "arm64" : arch === "x64" || arch === "x86_64" || arch === "amd64" ? "x64" : null;
+	if (!cpu) return null;
+	const target = `${os}-${cpu}`;
+	return isReleaseTarget(target) ? target : null;
+}
+function lookupTarget(manifest, platform, arch) {
+	const target = hostReleaseTarget(platform, arch);
+	if (!target) return {
+		ok: false,
+		reason: "unsupported-host",
+		target: null
+	};
+	const entry = manifest.targets[target];
+	if (!entry) return {
+		ok: false,
+		reason: "missing-from-manifest",
+		target
+	};
+	return {
+		ok: true,
+		target,
+		entry
+	};
+}
+
+//#endregion
+//#region src/update-check/versions.ts
+/** Canary builds carry a prerelease suffix (`X.Y.Z-beta.N`, synthesized in
+* CI); a plain semver is a stable release. An unparseable version defaults
+* to stable. */
+function resolveChannel(version) {
+	return (semver.prerelease(version, { loose: true })?.length ?? 0) > 0 ? "canary" : "stable";
+}
+/** npm dist-tag for a channel (see release-skydive-cli.yml). */
+function distTagForChannel(channel) {
+	return channel === "canary" ? "beta" : "latest";
+}
+/**
+* True when `candidate` is a strictly newer release than `current`, per
+* semver precedence (the `semver` package, including prerelease ordering).
+* Unparseable input is never newer, so garbage from the registry can't
+* produce a notice.
+*/
+function isNewerVersion(candidate, current) {
+	if (!semver.valid(candidate, { loose: true })) return false;
+	if (!semver.valid(current, { loose: true })) return false;
+	return semver.gt(candidate, current, { loose: true });
+}
+
+//#endregion
+//#region src/update-check/install.ts
+/**
+* The self-updater for compiled-binary installs. The update *check*
+* (./index.ts) is notify-only; this is what a user-invoked `skydive update`
+* (../commands/update.ts) runs to actually replace the binary.
+*
+* package-manager installs are never self-mutated here — that's the install
+* mode's own tool's job, and silently reaching into a global npm/yarn/pnpm
+* prefix is exactly the footgun the existing notice policy avoids. The
+* command handles that mode by printing the upgrade command; this module is
+* binary-only.
+*
+* The dangerous part is replacing a running executable in place, so the flow
+* is split: a pure {@link planUpdate} decides *whether* and *what* (testable
+* with no IO), and {@link downloadAndVerify} / {@link applyBinary} do the IO
+* with integrity checks and an atomic rename.
+*/
+/** Cap so a wrong URL or a hung CDN can't wedge `skydive update` forever. */
+const DOWNLOAD_TIMEOUT_MS = 6e4;
+/**
+* Decide what `skydive update` should do, given the running version, the
+* install source, the fetched manifest (or null), and this host. Pure — no
+* network, no filesystem — so every branch is unit-testable.
+*
+* `allowSameVersion` forces a reinstall of the current version (the `--force`
+* escape hatch for a corrupt binary); `allowDowngrade` lets an explicit
+* pinned/older manifest install over a newer running binary (rollback).
+*/
+function planUpdate(opts) {
+	const { currentVersion, source, manifest, platform, arch } = opts;
+	if (source !== "binary") return {
+		kind: "unsupported-source",
+		source,
+		latestVersion: manifest?.version ?? currentVersion
+	};
+	if (!manifest) return {
+		kind: "up-to-date",
+		currentVersion
+	};
+	const newer = isNewerVersion(manifest.version, currentVersion);
+	const same = manifest.version === currentVersion;
+	if (!(newer || same && opts.allowSameVersion === true || !newer && !same && opts.allowDowngrade === true)) return {
+		kind: "up-to-date",
+		currentVersion
+	};
+	const lookup = lookupTarget(manifest, platform, arch);
+	if (!lookup.ok) return lookup.reason === "unsupported-host" ? {
+		kind: "unsupported-host",
+		platform,
+		arch
+	} : {
+		kind: "missing-from-manifest",
+		target: lookup.target,
+		version: manifest.version
+	};
+	return {
+		kind: "update",
+		target: lookup.target,
+		version: manifest.version,
+		key: lookup.entry.key,
+		sha256: lookup.entry.sha256,
+		size: lookup.entry.size
+	};
+}
+var UpdateError = class extends Error {};
+/** Read a Node errno string (`EACCES`, `EROFS`, ...) off an unknown thrown
+* value without a type assertion — the property is validated before it's read. */
+function errnoCode(error) {
+	if (error && typeof error === "object" && "code" in error) {
+		const { code } = error;
+		if (typeof code === "string") return code;
+	}
+}
+/** Lowercase hex sha256 of a buffer, for comparing against the manifest. */
+function sha256Hex(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+* Download the release object and verify its digest before it ever touches
+* the install path. Returns the raw bytes; the caller writes them atomically.
+* Throws {@link UpdateError} (with an actionable message) on any HTTP,
+* timeout, or integrity failure — never a bare fetch error.
+*/
+async function downloadAndVerify(opts) {
+	const url = `${opts.downloadBaseUrl}/${opts.key}`;
+	const doFetch = opts.fetchImpl ?? fetch;
+	const signal = opts.signal ?? AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS);
+	let response;
+	try {
+		response = await doFetch(url, {
+			signal,
+			redirect: "follow"
+		});
+	} catch (error) {
+		throw new UpdateError(`download failed from ${url}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (!response.ok) throw new UpdateError(`download failed from ${url}: HTTP ${response.status}`);
+	const bytes = new Uint8Array(await response.arrayBuffer());
+	if (bytes.byteLength === 0) throw new UpdateError(`download from ${url} was empty`);
+	const actual = sha256Hex(bytes);
+	if (actual !== opts.expectedSha256) throw new UpdateError(`sha256 mismatch (expected ${opts.expectedSha256}, got ${actual}) — the download may be corrupt; re-run \`skydive update\``);
+	return bytes;
+}
+/**
+* Atomically replace the executable at `destPath` with `bytes`. The temp file
+* is written in the *same directory* as the target so the final `rename` is
+* atomic (rename across filesystems is not) — a crash mid-update leaves either
+* the old binary or the new one, never a truncated file.
+*
+* On a locked destination (Windows, or a read-only install dir) the rename
+* fails; we surface an actionable UpdateError instead of a raw errno. macOS
+* and Linux happily rename over a running executable (the old inode stays
+* live for the current process), which is what makes in-place self-update
+* safe here.
+*/
+async function applyBinary(destPath, bytes) {
+	const dir = path.dirname(destPath);
+	const tmp = path.join(dir, `.skydive-update-${process.pid}-${Date.now()}.tmp`);
+	try {
+		await fsp.writeFile(tmp, bytes, { mode: 493 });
+		await fsp.chmod(tmp, 493);
+		await fsp.rename(tmp, destPath);
+	} catch (error) {
+		await fsp.rm(tmp, { force: true }).catch(() => {});
+		const code = errnoCode(error);
+		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new UpdateError(`cannot write ${destPath} (permission denied). Re-run with the right permissions, or reinstall with the install script.`);
+		throw new UpdateError(`failed to install the new binary at ${destPath}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+/**
+* Resolve the path of the currently running executable to overwrite. For a
+* `bun --compile` binary that's `process.execPath`; we resolve symlinks so a
+* `~/.local/bin/skydive` symlink into a versioned store updates the real
+* file, not the link. Returns null when the path can't be determined (e.g. a
+* non-binary context), which the command treats as "can't self-update".
+*/
+function resolveSelfPath(execPath = process.execPath) {
+	if (!execPath) return null;
+	try {
+		return fs.realpathSync(execPath);
+	} catch (_error) {
+		return execPath;
+	}
+}
+
+//#endregion
+//#region src/update-check/sources.ts
+function resolveInstallSource() {
+	return typeof SKYDIVE_CLI_INSTALL_SOURCE === "string" && SKYDIVE_CLI_INSTALL_SOURCE === "binary" ? "binary" : "package-manager";
+}
+const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+const npmDistTagsSchema = z.record(z.string(), z.unknown());
+const binaryManifestSchema = z.object({ version: z.unknown().optional() });
+/** npm dist-tags for the published package (`skydive-cli`). */
+const npmReleaseSource = {
+	async fetchLatestVersion(channel, { signal }) {
+		const response = await fetch(`${NPM_REGISTRY_URL}/-/package/${name}/dist-tags`, {
+			signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return null;
+		const tags = npmDistTagsSchema.safeParse(await response.json());
+		if (!tags.success) return null;
+		const version = tags.data[distTagForChannel(channel)];
+		return typeof version === "string" ? version : null;
+	},
+	async fetchManifest() {
+		return null;
+	}
+};
+/**
+* Release CDN (CloudFront over the releases bucket, infra: CliReleasesCdn).
+* Serves the channel pointers the release workflow uploads
+* (`channels/{stable,canary}.json`, cached max-age=60) alongside the
+* binaries. The daily poll goes here, not to the api, so a fleet of
+* installed binaries puts no load on — and takes no dependency on — the api.
+*/
+const RELEASE_CDN_URL = "https://dl.skydive.com";
+/** Channel manifest on the release CDN, for compiled binaries. The same
+* document the api's channel route serves (see
+* apps/anyone/api/src/routes/cli-releases.ts, which reads it from the
+* bucket this CDN fronts). */
+const binaryReleaseSource = {
+	async fetchLatestVersion(channel, { signal }) {
+		const response = await fetch(`${RELEASE_CDN_URL}/channels/${channel}.json`, {
+			signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return null;
+		const manifest = binaryManifestSchema.safeParse(await response.json());
+		if (!manifest.success) return null;
+		return typeof manifest.data.version === "string" ? manifest.data.version : null;
+	},
+	async fetchManifest(channel, { signal }) {
+		const response = await fetch(`${RELEASE_CDN_URL}/channels/${channel}.json`, {
+			signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return null;
+		const manifest = releaseManifestSchema.safeParse(await response.json());
+		return manifest.success ? manifest.data : null;
+	}
+};
+function releaseSourceForInstall(source) {
+	return source === "binary" ? binaryReleaseSource : npmReleaseSource;
+}
+
+//#endregion
+//#region src/update-check/notice.ts
+/** The install-mode-specific action line. A package-manager install is never
+* self-mutated — we only tell the user what to run. A binary install has a
+* built-in self-updater (`skydive update`, ../commands/update.ts), so that's
+* the action; the curl re-install stays the documented fallback. */
+function renderUpdateCommand(channel, source) {
+	if (source === "binary") return channel === "canary" ? "skydive update --channel canary" : "skydive update";
+	return `npm install -g ${name}@${distTagForChannel(channel)}`;
+}
+function renderUpdateNotice(opts) {
+	return `\nUpdate available: ${opts.currentVersion} \u2192 ${opts.latestVersion}\nRun ${renderUpdateCommand(opts.channel, opts.source)}\n`;
+}
+/**
+* Whether this invocation may print the notice. Pure so it's testable; the
+* inputs are raw pre-yargs argv (parsing hasn't happened when this runs) and
+* stderr's TTY-ness. `--json`/`--quiet` go to stdout, and the notice goes to
+* stderr — but scripts commonly capture 2>&1, so machine-readable modes
+* suppress it entirely rather than risk corrupting piped output.
+*/
+function shouldNotify(opts) {
+	if (!opts.stderrIsTTY) return false;
+	if (opts.argv.includes("--json") || opts.argv.includes("--quiet")) return false;
+	return true;
+}
+
+//#endregion
+//#region src/update-check/package-manager.ts
+const KNOWN = [
+	"npm",
+	"yarn",
+	"pnpm",
+	"bun"
+];
+function isKnown(value) {
+	return KNOWN.some((m) => m === value);
+}
+/**
+* Parse the manager name out of an `npm_config_user_agent` string. npm, yarn,
+* pnpm and bun all set it to `"<manager>/<version> ..."` when they spawn a
+* script, which is the most reliable signal for how *this* process was
+* launched. Returns null when the var is absent or unrecognized.
+*/
+function parseUserAgent(userAgent) {
+	if (!userAgent) return null;
+	const name = userAgent.trim().split("/")[0]?.toLowerCase();
+	return name && isKnown(name) ? name : null;
+}
+/**
+* Best-effort detection of the manager that owns this install. Order of
+* signals, most to least reliable:
+*   1. `npm_config_user_agent` — set by the manager that spawned us.
+*   2. the executable path — a global bin under a `pnpm`/`yarn`/`bun` store
+*      names the manager even when we weren't spawned by it (e.g. the user
+*      typed `skydive` directly).
+* Falls back to `npm`, the documented default install path, so the command we
+* show is always runnable — the prompt still lets the user decline and copy a
+* different one.
+*/
+function detectPackageManager(opts) {
+	const fromUa = parseUserAgent(opts.env["npm_config_user_agent"]);
+	if (fromUa) return fromUa;
+	const exec = opts.execPath.toLowerCase();
+	if (exec.includes("pnpm")) return "pnpm";
+	if (exec.includes("yarn")) return "yarn";
+	if (exec.includes("bun")) return "bun";
+	return "npm";
+}
+/**
+* The global-install command (as argv) for a manager + channel. Each manager's
+* global-add spelling differs; the version target is the channel's dist-tag
+* (`latest`/`beta`), matching what the release workflow publishes.
+*/
+function installCommand(manager, channel) {
+	const spec = `${name}@${distTagForChannel(channel)}`;
+	switch (manager) {
+		case "npm": return [
+			"npm",
+			"install",
+			"-g",
+			spec
+		];
+		case "pnpm": return [
+			"pnpm",
+			"add",
+			"-g",
+			spec
+		];
+		case "bun": return [
+			"bun",
+			"add",
+			"-g",
+			spec
+		];
+		case "yarn": return [
+			"yarn",
+			"global",
+			"add",
+			spec
+		];
+	}
+}
+/** The command as a copy-pasteable string for prompts and notices. */
+function installCommandString(manager, channel) {
+	return installCommand(manager, channel).join(" ");
+}
+
+//#endregion
+//#region src/update-check/pm-update.ts
+/**
+* The interactive upgrade path for a package-manager install: instead of only
+* printing "run npm install -g …", offer to run it now, and on confirm run
+* that exact command and relaunch the CLI on the new version.
+*
+* We never silently mutate a package-manager install (the manager owns it),
+* but an explicit prompt the user answers with a keypress is honest consent —
+* and it runs the *same* command we detected + display, so what you approve is
+* what executes. Non-interactive contexts (no TTY, --json/--quiet, CI) skip
+* the prompt entirely and fall back to the printed notice.
+*/
+/** Whether it's safe to show an interactive prompt at all. */
+function canPromptInteractively(opts) {
+	if (opts.json || opts.quiet) return false;
+	if (!opts.stdinIsTTY || !opts.stdoutIsTTY) return false;
+	if (opts.env["CI"] || opts.env["SKYDIVE_NO_UPDATE_CHECK"]) return false;
+	return true;
+}
+/**
+* Interpret a raw prompt answer. Default (empty / Enter) is **yes** — the
+* prompt renders `[Y/n]`, so a bare Enter accepts. Anything starting with `n`
+* (case-insensitive) is no; any other non-empty input is treated as no too,
+* so a fat-fingered answer never runs an install the user didn't mean.
+*/
+function interpretYesNo(answer) {
+	const a = answer.trim().toLowerCase();
+	if (a === "") return true;
+	return a === "y" || a === "yes";
+}
+/** Ask a `[Y/n]` question on the TTY and resolve to the boolean answer. */
+async function promptYesNo(question) {
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		return interpretYesNo(await new Promise((resolve) => {
+			rl.question(question, resolve);
+		}));
+	} finally {
+		rl.close();
+	}
+}
+/**
+* Offer + run the package-manager upgrade. Returns a result the caller turns
+* into output and an exit/relaunch decision — kept separate from the actual
+* relaunch so it's testable without re-execing the test runner.
+*/
+async function offerPackageManagerUpdate(opts) {
+	const manager = detectPackageManager({
+		env: opts.env,
+		execPath: opts.execPath
+	});
+	const command = installCommand(manager, opts.channel);
+	const commandStr = installCommandString(manager, opts.channel);
+	if (!opts.interactive) return { status: "skipped-noninteractive" };
+	if (!await (opts.ask ?? promptYesNo)(`Update available: ${opts.currentVersion} \u2192 ${opts.latestVersion}\nRun \`${commandStr}\` now? [Y/n] `)) return { status: "declined" };
+	const { status } = (opts.run ?? ((cmd) => {
+		const [bin, ...args] = cmd;
+		return { status: spawnSync(bin ?? "", args, { stdio: "inherit" }).status };
+	}))(command);
+	if (status !== 0) return {
+		status: "failed",
+		code: status,
+		command: commandStr
+	};
+	return {
+		status: "installed",
+		command: commandStr
+	};
+}
+/**
+* Relaunch the CLI after a successful in-place upgrade so the user lands back
+* on their command running the new version. Uses the same interpreter + argv
+* the current process was launched with; detaches so the parent can exit
+* cleanly. Never throws — a failed relaunch just means the user re-runs
+* manually, which the caller's message covers.
+*/
+function relaunchCli(argv = process.argv) {
+	try {
+		const [, script, ...rest] = argv;
+		spawn(process.execPath, script ? [script, ...rest] : rest, { stdio: "inherit" }).on("exit", (code) => process.exit(code ?? 0));
+	} catch (_error) {
+		process.exit(0);
+	}
+}
+
+//#endregion
+//#region src/commands/update.ts
+/**
+* `skydive update` — the user-invoked self-updater the update *check*
+* (../update-check/index.ts) has always pointed at. Notify-only remains the
+* automatic behavior; this is the explicit "do it now" action.
+*
+* Binary installs self-update in place (download -> verify sha256 -> atomic
+* replace); package-manager installs are never self-mutated (the notice
+* policy) — we print the exact upgrade command instead. `--check` is a dry
+* run; `--force` reinstalls the current version (repair a corrupt binary).
+*/
+const FETCH_TIMEOUT_MS$1 = 15e3;
+function normalizeChannel(raw, currentVersion) {
+	if (raw === "stable" || raw === "canary") return raw;
+	return resolveChannel(currentVersion);
+}
+/** Human-readable line for a plan outcome. Pure so the handler stays thin. */
+function describePlan(plan, channel, isCheck) {
+	switch (plan.kind) {
+		case "up-to-date": return `Already on the latest ${channel} release (${plan.currentVersion}).`;
+		case "unsupported-source": return `This is a ${plan.source} install, so update through your package manager:\n  ${renderUpdateCommand(channel, plan.source)}`;
+		case "unsupported-host": return `No Skydive binary is published for ${plan.platform}/${plan.arch}.`;
+		case "missing-from-manifest": return `The ${channel} ${plan.version} release has no binary for your platform (${plan.target}).`;
+		case "update": return isCheck ? `Update available: ${version} \u2192 ${plan.version} (${channel}, ${plan.target}).\nRun \`skydive update\` to install it.` : `Updating ${version} \u2192 ${plan.version} (${channel}, ${plan.target})...`;
+	}
+}
+const updateCommand = {
+	command: "update",
+	describe: "Update the Skydive CLI to the latest release",
+	builder: (y) => y.option("channel", {
+		type: "string",
+		choices: ["stable", "canary"],
+		describe: "Release channel to update to (default: this build's channel)"
+	}).option("check", {
+		type: "boolean",
+		default: false,
+		describe: "Only report whether an update is available; don't install"
+	}).option("force", {
+		type: "boolean",
+		default: false,
+		describe: "Reinstall the current version even if already up to date (repairs a corrupt binary)"
+	}).example("skydive update", "Install the latest release").example("skydive update --check", "See if an update is available").example("skydive update --channel canary", "Switch to the canary line"),
+	handler: async (argv) => {
+		const currentVersion = version;
+		const source = resolveInstallSource();
+		const channel = normalizeChannel(argv.channel, currentVersion);
+		const manifest = await releaseSourceForInstall(source).fetchManifest(channel, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS$1) }).catch(() => null);
+		if (source === "binary" && manifest === null) {
+			if (argv.json) {
+				output(argv, {
+					status: "unavailable",
+					channel,
+					currentVersion
+				});
+				return;
+			}
+			throw new UpdateError(`couldn't reach the ${channel} release channel — check your connection and try again.`);
+		}
+		const plan = planUpdate({
+			currentVersion,
+			source,
+			manifest,
+			platform: process.platform,
+			arch: process.arch,
+			allowSameVersion: argv.force
+		});
+		if (argv.json) {
+			output(argv, {
+				plan,
+				channel,
+				currentVersion,
+				dryRun: argv.check
+			});
+			return;
+		}
+		if (plan.kind === "unsupported-source" && !argv.check) {
+			const interactive = canPromptInteractively({
+				stdinIsTTY: Boolean(process.stdin.isTTY),
+				stdoutIsTTY: Boolean(process.stdout.isTTY),
+				json: argv.json,
+				quiet: argv.quiet,
+				env: process.env
+			});
+			const result = await offerPackageManagerUpdate({
+				channel,
+				currentVersion,
+				latestVersion: plan.latestVersion,
+				env: process.env,
+				execPath: process.execPath,
+				interactive
+			});
+			switch (result.status) {
+				case "installed":
+					console.log(`Updated via \`${result.command}\`. Relaunching \`skydive\`...`);
+					relaunchCli();
+					return;
+				case "failed": throw new UpdateError(`\`${result.command}\` exited with code ${result.code ?? "unknown"}. Try running it yourself.`);
+				case "declined":
+					console.log(describePlan(plan, channel, false));
+					return;
+				case "skipped-noninteractive":
+					console.log(describePlan(plan, channel, false));
+					return;
+			}
+		}
+		if (plan.kind !== "update" || argv.check) {
+			console.log(describePlan(plan, channel, argv.check));
+			return;
+		}
+		const selfPath = resolveSelfPath();
+		if (!selfPath) throw new UpdateError("couldn't determine this binary's path to replace it — reinstall with the install script instead.");
+		console.log(describePlan(plan, channel, false));
+		await applyBinary(selfPath, await downloadAndVerify({
+			downloadBaseUrl: RELEASE_CDN_URL,
+			key: plan.key,
+			expectedSha256: plan.sha256
+		}));
+		console.log(`Updated to ${plan.version}. Run \`skydive --version\` to confirm.`);
+	}
+};
+
 //#endregion
 //#region src/cli.ts
 function createCli(argv) {
@@ -2270,7 +2896,7 @@ function createCli(argv) {
 		type: "string",
 		global: true,
 		describe: "Override API base URL"
-	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(importCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
+	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(importCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).command(updateCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
 		printError(err ? err instanceof Error ? err.message : String(err) : msg ?? "Unknown error");
 		process.exit(1);
 	});
@@ -2382,100 +3008,6 @@ function isCheckDue(lastCheckedAt, now = Date.now()) {
 	return now - then >= CHECK_INTERVAL_MS;
 }
 
-//#endregion
-//#region src/update-check/versions.ts
-/** Canary builds carry a prerelease suffix (`X.Y.Z-beta.N`, synthesized in
-* CI); a plain semver is a stable release. An unparseable version defaults
-* to stable. */
-function resolveChannel(version) {
-	return (semver.prerelease(version, { loose: true })?.length ?? 0) > 0 ? "canary" : "stable";
-}
-/** npm dist-tag for a channel (see release-skydive-cli.yml). */
-function distTagForChannel(channel) {
-	return channel === "canary" ? "beta" : "latest";
-}
-/**
-* True when `candidate` is a strictly newer release than `current`, per
-* semver precedence (the `semver` package, including prerelease ordering).
-* Unparseable input is never newer, so garbage from the registry can't
-* produce a notice.
-*/
-function isNewerVersion(candidate, current) {
-	if (!semver.valid(candidate, { loose: true })) return false;
-	if (!semver.valid(current, { loose: true })) return false;
-	return semver.gt(candidate, current, { loose: true });
-}
-
-//#endregion
-//#region src/update-check/notice.ts
-/** The install-mode-specific action line. A package-manager install is never
-* self-mutated — we only tell the user what to run. */
-function renderUpdateCommand(channel, source) {
-	if (source === "binary") return `curl -fsSL ${DEFAULT_WEB_URL}/api/v1/cli/install.sh | ${channel === "canary" ? "SKYDIVE_CHANNEL=canary " : ""}sh`;
-	return `npm install -g ${name}@${distTagForChannel(channel)}`;
-}
-function renderUpdateNotice(opts) {
-	return `\nUpdate available: ${opts.currentVersion} \u2192 ${opts.latestVersion}\nRun ${renderUpdateCommand(opts.channel, opts.source)}\n`;
-}
-/**
-* Whether this invocation may print the notice. Pure so it's testable; the
-* inputs are raw pre-yargs argv (parsing hasn't happened when this runs) and
-* stderr's TTY-ness. `--json`/`--quiet` go to stdout, and the notice goes to
-* stderr — but scripts commonly capture 2>&1, so machine-readable modes
-* suppress it entirely rather than risk corrupting piped output.
-*/
-function shouldNotify(opts) {
-	if (!opts.stderrIsTTY) return false;
-	if (opts.argv.includes("--json") || opts.argv.includes("--quiet")) return false;
-	return true;
-}
-
-//#endregion
-//#region src/update-check/sources.ts
-function resolveInstallSource() {
-	return typeof SKYDIVE_CLI_INSTALL_SOURCE === "string" && SKYDIVE_CLI_INSTALL_SOURCE === "binary" ? "binary" : "package-manager";
-}
-const NPM_REGISTRY_URL = "https://registry.npmjs.org";
-const npmDistTagsSchema = z.record(z.string(), z.unknown());
-const binaryManifestSchema = z.object({ version: z.unknown().optional() });
-/** npm dist-tags for the published package (`skydive-cli`). */
-const npmReleaseSource = { async fetchLatestVersion(channel, { signal }) {
-	const response = await fetch(`${NPM_REGISTRY_URL}/-/package/${name}/dist-tags`, {
-		signal,
-		headers: { accept: "application/json" }
-	});
-	if (!response.ok) return null;
-	const tags = npmDistTagsSchema.safeParse(await response.json());
-	if (!tags.success) return null;
-	const version = tags.data[distTagForChannel(channel)];
-	return typeof version === "string" ? version : null;
-} };
-/**
-* Release CDN (CloudFront over the releases bucket, infra: CliReleasesCdn).
-* Serves the channel pointers the release workflow uploads
-* (`channels/{stable,canary}.json`, cached max-age=60) alongside the
-* binaries. The daily poll goes here, not to the api, so a fleet of
-* installed binaries puts no load on — and takes no dependency on — the api.
-*/
-const RELEASE_CDN_URL = "https://dl.skydive.com";
-/** Channel manifest on the release CDN, for compiled binaries. The same
-* document the api's channel route serves (see
-* apps/anyone/api/src/routes/cli-releases.ts, which reads it from the
-* bucket this CDN fronts). */
-const binaryReleaseSource = { async fetchLatestVersion(channel, { signal }) {
-	const response = await fetch(`${RELEASE_CDN_URL}/channels/${channel}.json`, {
-		signal,
-		headers: { accept: "application/json" }
-	});
-	if (!response.ok) return null;
-	const manifest = binaryManifestSchema.safeParse(await response.json());
-	if (!manifest.success) return null;
-	return typeof manifest.data.version === "string" ? manifest.data.version : null;
-} };
-function releaseSourceForInstall(source) {
-	return source === "binary" ? binaryReleaseSource : npmReleaseSource;
-}
-
 //#endregion
 //#region src/update-check/index.ts
 /**

package/dist/js/{boot-CaWHIM4R.mjs → boot-CI6nXtmu.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { C as setActiveWorkspace, S as listWorkspaces, a as WORDMARK, b as getActiveWorkspaceId, c as applyTheme, d as noColorRequested, f as theme, g as themeVersion, h as themeModeFromColorFgBg, i as MARK_CELLS, l as findTheme, m as themeMode, n as buildCrashReport, p as themeForMode, r as writeCrashReport, s as DEFAULT_THEME_ID, t as installCrashHandler, u as monoTheme, v as themesForMode } from "./install-BhPuzBxW.mjs";
-import { E as getSavedTheme, F as resolveWebUrl, R as saveTheme, S as getConfigPath, T as getReviewStateDir, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, i as resolveAgent, l as parseExternalOauthConnectParams, m as specKeyFor, p as parseConnectCard, s as MASK_CHAR, u as parseOauthConnectParams, v as DEFAULT_API_URL, y as DEFAULT_APP_URL } from "./print-CNIvmpqW.mjs";
+import { C as setActiveWorkspace, S as listWorkspaces, a as WORDMARK, b as getActiveWorkspaceId, c as applyTheme, d as noColorRequested, f as theme, g as themeVersion, h as themeModeFromColorFgBg, i as MARK_CELLS, l as findTheme, m as themeMode, n as buildCrashReport, p as themeForMode, r as writeCrashReport, s as DEFAULT_THEME_ID, t as installCrashHandler, u as monoTheme, v as themesForMode } from "./install-DKTnh1gy.mjs";
+import { L as saveTheme, P as resolveWebUrl, T as getSavedTheme, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, i as resolveAgent, l as parseExternalOauthConnectParams, m as specKeyFor, p as parseConnectCard, s as MASK_CHAR, u as parseOauthConnectParams, v as DEFAULT_API_URL, w as getReviewStateDir, x as getConfigPath, y as DEFAULT_APP_URL } from "./print-DaPpTqxu.mjs";
 import { a as errorMessage, i as sendErrorMessage, n as createRestClient, o as isRecord, r as errorDetail, t as HttpError } from "./rest-Q5yl_b2-.mjs";
 import { t as PortalClient } from "./client-DT9bWi1D.mjs";
 import { d as makeLineParser, f as parseDaemonMessage, l as daemonPaths, n as ensureDaemonRunning, s as LOCAL_PROTOCOL_VERSION, u as encodeLine } from "./daemon-DfMgVlYE.mjs";

package/dist/js/{install-BhPuzBxW.mjs → install-DKTnh1gy.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { S as getConfigPath } from "./print-CNIvmpqW.mjs";
+import { x as getConfigPath } from "./print-DaPpTqxu.mjs";
 import os from "node:os";
 import path from "node:path";
 import { err, ok } from "neverthrow";
@@ -8,7 +8,7 @@ import fs from "node:fs";
 
 //#region package.json
 var name = "skydive-cli";
-var version$1 = "0.2.0-beta.618";
+var version$1 = "0.2.0-beta.624";
 
 //#endregion
 //#region src/auth/organization.ts

package/dist/js/{print-nefugWMx.mjs → print-CB6L_1YB.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-CNIvmpqW.mjs";
+import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-DaPpTqxu.mjs";
 import "./rest-Q5yl_b2-.mjs";
 
 export { messageGet, readStdin, resolveAgent, runPrint };

package/dist/js/{print-CNIvmpqW.mjs → print-DaPpTqxu.mjs}

@@ -677,4 +677,4 @@ async function readStdin() {
 }
 
 //#endregion
-export { getUpdateCheckDisabled as A, getLastSeenVersion as C, getShareMachineDefault as D, getSavedTheme as E, resolveWebUrl as F, saveConfig as I, saveSession as L, resolveConfig as M, resolveManagementAuth as N, getStoredApiKeyId as O, resolveSession as P, saveTheme as R, getConfigPath as S, getReviewStateDir as T, API_KEY_PREFIX as _, runPrint as a, DEFAULT_WEB_URL as b, cardActionErrorMessage as c, reconcileMaskedInput as d, resolveConnectUrl as f, API_KEY_FAMILY_PREFIX as g, API_KEYS_URL as h, resolveAgent as i, resolveAppUrl as j, getStoredApiKeyWorkspaceName as k, parseExternalOauthConnectParams as l, specKeyFor as m, messageGet as n, toPrintError as o, parseConnectCard as p, readStdin as r, MASK_CHAR as s, collectRunText as t, parseOauthConnectParams as u, DEFAULT_API_URL as v, getPromptHistoryPath as w, deleteConfig as x, DEFAULT_APP_URL as y, setLastSeenVersion as z };
+export { resolveAppUrl as A, getPromptHistoryPath as C, getStoredApiKeyId as D, getShareMachineDefault as E, saveConfig as F, saveSession as I, saveTheme as L, resolveManagementAuth as M, resolveSession as N, getStoredApiKeyWorkspaceName as O, resolveWebUrl as P, setLastSeenVersion as R, getLastSeenVersion as S, getSavedTheme as T, API_KEY_PREFIX as _, runPrint as a, deleteConfig as b, cardActionErrorMessage as c, reconcileMaskedInput as d, resolveConnectUrl as f, API_KEY_FAMILY_PREFIX as g, API_KEYS_URL as h, resolveAgent as i, resolveConfig as j, getUpdateCheckDisabled as k, parseExternalOauthConnectParams as l, specKeyFor as m, messageGet as n, toPrintError as o, parseConnectCard as p, readStdin as r, MASK_CHAR as s, collectRunText as t, parseOauthConnectParams as u, DEFAULT_API_URL as v, getReviewStateDir as w, getConfigPath as x, DEFAULT_APP_URL as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.2.0-beta.618",
+  "version": "0.2.0-beta.624",
   "description": "Skydive CLI — cloud agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",